3 ms·

> IMO, all it takes is a small band of trolls who want to harm your company to start to cause problems. I suspect strongly the courts will use their energy to

by geocar 9y ago

> IMO, all it takes is a small band of trolls who want to harm your company to start to cause problems. I suspect strongly the courts will use their energy to go after the biggest most flagrant violators of European law first: the equifaxes, facebooks, googles, and so on. The fines are there for those companies who continue to have a flagrant disregard for IT security practices, or who try to make personal data their business by trying to trick the subject instead of offering real value in trade. If you’re not trying to play legal chicken with privacy law, you know what personal data you have and protect it like your business depends on it, then you’re probably going to be fine. And unless you’re a lawyer or familiar with how European courts do things, I think a more plain language guide is better: https://ico.org.uk/for-organisations/guide-to-data-protection/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

woolvalley 9y ago
The facebooks and googles can afford to follow GDPR. If you know some people that work there, you'll realize there have been multi-year efforts to become GDPR compliant in those companies. It's the small companies who literally can't afford the staff to properly implement the GDPR. It looks like it's turning into a regulatory barrier that protects the big guys and scares the small guys away. There is nothing in the GDPR that says: "if your a small < 5 person corp not in europe that isn't a subsidary of another corporation, then the GDPR does not apply (ie: Joe's blog, Sue's landscaping)". Or "If your revenues & employee counts are within this band, then the maximum fine can only be applied on a percentage basis and not millions.". IF these regulators really didn't want to scare away the small guys, they would of put that into the law. "Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations.
- geocar 9y ago
  “Following the GDPR” is easy for most companies because the amount of personal data they keep and have at risk is extremely low. The ICO has some great guidance for them: https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > “Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations. The GDPR is already law and people, and corporations are still here. That’s how courts work in Europe. They can fine you for hurting consumers or putting them at risk even if the specific actions you’re taking aren’t necessarily coded and specified. As an American living here I understand how strange that can seem, but the advantage is that companies getting prepared for the GDPR are treating the personal data they keep as a liability instead of treating it as an asset.
kodablah 9y ago
> I suspect [...] probably [...] This kind of subjective enforcement annoys me. In the meantime, in my risk assessment I have to weigh the largest possible risk. It is quite strange how often many EU laws are defended because of enforcement and not the letter of the law. If they are only going after the most flagrant, codify it. If they are not going to put SMB's out of business with a maximum fine, codify it. This article is a "trust us" which I abhor in lieu of more specific punishment rules. The rest of us running SMBs and not needing more customers in the EU are just not going to gamble with what side of the bed the punishers wake up on.
- geocar 9y ago
  The ICO (for example) has excellent English-language guidance on the GDPR. https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > codify it It is very difficult in my experience to make lawmakers and lawyers experts in digital marketing, telesales, medical processing, machine learning, banking and anti-money laundering and so on, so a lot of our regulation is just “do your best” and “don’t be a dick” anyway. This works remarkably well- CEOs of billion dollar companies are asking if their IT/IS systems are actually secure which is a massive improvement over what I used to see: “are we compliant” Well Equifax was probably compliant. I much prefer companies seek more than sheer profit, and to have restraint when it comes to putting peoples lives and livelihoods at risk. > (we) are just not going to gamble with what side of the bed the punishers wake up on. With all due respect, unless you go to war (which has different risks), or you ask everyone if they’re European when they reach your website (ie before you’ve given them a cookie or logged their data in your access logs; or telephone and so on) you’re going to have to. The GDPR is already law. The good news is that European law is rather fair, and if you’re not dealing with personal data as a product you probably aren’t going to be affected at all.

by geocar 9y ago

woolvalley 9y ago

The facebooks and googles can afford to follow GDPR. If you know some people that work there, you'll realize there have been multi-year efforts to become GDPR compliant in those companies. It's the small companies who literally can't afford the staff to properly implement the GDPR. It looks like it's turning into a regulatory barrier that protects the big guys and scares the small guys away. There is nothing in the GDPR that says: "if your a small < 5 person corp not in europe that isn't a subsidary of another corporation, then the GDPR does not apply (ie: Joe's blog, Sue's landscaping)". Or "If your revenues & employee counts are within this band, then the maximum fine can only be applied on a percentage basis and not millions.". IF these regulators really didn't want to scare away the small guys, they would of put that into the law. "Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations.

geocar 9y ago
“Following the GDPR” is easy for most companies because the amount of personal data they keep and have at risk is extremely low. The ICO has some great guidance for them: https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > “Don't worry, the european courts are nice people" is not a strong enough guarantee for most people and corporations. The GDPR is already law and people, and corporations are still here. That’s how courts work in Europe. They can fine you for hurting consumers or putting them at risk even if the specific actions you’re taking aren’t necessarily coded and specified. As an American living here I understand how strange that can seem, but the advantage is that companies getting prepared for the GDPR are treating the personal data they keep as a liability instead of treating it as an asset.

kodablah 9y ago

> I suspect [...] probably [...] This kind of subjective enforcement annoys me. In the meantime, in my risk assessment I have to weigh the largest possible risk. It is quite strange how often many EU laws are defended because of enforcement and not the letter of the law. If they are only going after the most flagrant, codify it. If they are not going to put SMB's out of business with a maximum fine, codify it. This article is a "trust us" which I abhor in lieu of more specific punishment rules. The rest of us running SMBs and not needing more customers in the EU are just not going to gamble with what side of the bed the punishers wake up on.

geocar 9y ago
The ICO (for example) has excellent English-language guidance on the GDPR. https://ico.org.uk/for-organisations/business/ https://ico.org.uk/for-organisations/business/ > codify it It is very difficult in my experience to make lawmakers and lawyers experts in digital marketing, telesales, medical processing, machine learning, banking and anti-money laundering and so on, so a lot of our regulation is just “do your best” and “don’t be a dick” anyway. This works remarkably well- CEOs of billion dollar companies are asking if their IT/IS systems are actually secure which is a massive improvement over what I used to see: “are we compliant” Well Equifax was probably compliant. I much prefer companies seek more than sheer profit, and to have restraint when it comes to putting peoples lives and livelihoods at risk. > (we) are just not going to gamble with what side of the bed the punishers wake up on. With all due respect, unless you go to war (which has different risks), or you ask everyone if they’re European when they reach your website (ie before you’ve given them a cookie or logged their data in your access logs; or telephone and so on) you’re going to have to. The GDPR is already law. The good news is that European law is rather fair, and if you’re not dealing with personal data as a product you probably aren’t going to be affected at all.